Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,074All CVEsplus 19,119 rejected
- 507Last 24 hours2,869 in the last 7 days
- 16,887Last 30 days1,546 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 8 | 19 | 13 | 0 | 0 | 40 | 41 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2023 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-106100 | Payload: Field-level write access bypass in Payload on MongoDBpayloadcms · payload | High7.1 |
| CVE-2026-105868 | Payload: Uploaded XML files could execute same-origin JavaScriptpayloadcms · payload | High8.6 |
| CVE-2026-105867 | Payload: Client uploads could overwrite S3 objectspayloadcms · payload | High7.1 |
| CVE-2026-105866 | Payload: Unauthenticated account-lockout denial of servicepayloadcms · payload | Medium6.9 |
| CVE-2026-105865 | Payload: Incomplete validation during the upload file lifecyclepayloadcms · payload | High8.1 |
| CVE-2026-105864 | Payload: Cross-tenant create in @payloadcms/plugin-multi-tenantpayloadcms · payload | Medium5.3 |
| CVE-2026-105863 | Payload authentication token field handling issuepayloadcms · payload | Critical9.2 |
| CVE-2026-105862 | Payload: Bypassed sanitization of user uploaded SVGspayloadcms · payload | High8.7 |
| CVE-2026-105861 | Payload external upload trust validation issuepayloadcms · payload | High7.2 |
| CVE-2026-105860 | Payload: Tenant authorization bypass in Multi-Tenant Pluginpayloadcms · payload | High7.1 |
| CVE-2026-105859 | Payload: Unauthorized update to collection documentspayloadcms · payload | Critical9.8 |
| CVE-2026-105858 | Payload: Remote Code Execution through first-registerpayloadcms · payload | High8.1 |
| CVE-2026-105857 | Payload: RCE in Payload Form Builderpayloadcms · payload | Critical10.0 |
| CVE-2026-105856 | Payload: SQL injection in SQLite/Postgrespayloadcms · payload | High8.6 |
| CVE-2026-105855 | Payload: Field-level password update restrictions were not enforcedpayloadcms · payload | High7.6 |
| CVE-2026-105854 | Payload: ReDoS in Multipart Content-Type Validationpayloadcms · payload | High8.7 |
| CVE-2026-105853 | Payload: Token refresh and password reset responses may expose restricted user fieldspayloadcms · payload | High7.1 |
| CVE-2026-105852 | Payload relationship-query authorization bypasspayloadcms · payload | Medium6.9 |
| CVE-2026-105851 | Payload: Field access control bypass on auth collectionspayloadcms · payload | Critical9.3 |
| CVE-2026-105850 | Payload: Order confirmation validation issue in Payload Ecommercepayloadcms · payload | High8.8 |
| CVE-2026-105849 | Payload: API key disclosure through ordinary document readspayloadcms · payload | High7.7 |
| CVE-2026-105848 | Payload: Insufficient Access Control in Stripe REST Proxypayloadcms · payload | Medium6.4 |
| CVE-2026-105847 | Payload: Polymorphic join queries could disclose hidden fieldspayloadcms · payload | High7.1 |
| CVE-2026-105846 | Payload: Untrusted redirect URL parameter exploitpayloadcms · payload | Medium6.1 |
| CVE-2026-105845 | Payload: SQL Injection in SQLite and Postgrespayloadcms · payload | Critical9.8 |
| CVE-2026-105844 | Payload: Prototype pollution in Payload Import Export pluginpayloadcms · payload | Critical9.3 |
| CVE-2026-105806 | Payload: Improper access control for MCP API keyspayloadcms · payload | High8.6 |
| CVE-2026-105805 | Payload: Sort queries could expose protected field informationpayloadcms · payload | Medium6.9 |
| CVE-2026-105804 | Payload: Password hashes use insufficient PBKDF2 iterationspayloadcms · payload | Medium5.7 |
| CVE-2026-93363 | Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Routepayloadcms · payload | Medium5.3 |
| CVE-2026-11779 | PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock accessPayloadCMS · PayloadCMS | Medium5.3 |
| CVE-2026-34750 | Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpointspayloadcms · payload | Medium6.5 |
| CVE-2026-34749 | Payload has a CSRF Protection Bypass in Authentication Flowpayloadcms · payload | Medium5.4 |
| CVE-2026-34748 | @payloadcms/next has Stored XSS in Admin Panelpayloadcms · payload | High8.7 |
| CVE-2026-34747 | Payload has an SQL Injection via Query Handlingpayloadcms · payload | High8.5 |
| CVE-2026-34746 | Payload has Authenticated SSRF via Upload Functionalitypayloadcms · payload | High7.7 |
| CVE-2026-34751 | Payload has Unvalidated Input in Password Recovery Endpointspayloadcms · payload | Critical9.1 |
| CVE-2026-27567 | Payload has Server-Side Request Forgery (SSRF) in External File URL Uploadspayloadcms · payload | Medium6.5 |
| CVE-2026-25544 | Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapterspayloadcms · payload | Critical9.8 |
| CVE-2026-25574 | Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)payloadcms · payload | Medium5.4 |
| CVE-2023-30843 | Payload's hidden fields can be leaked on readable collectionspayloadcms · payload | High7.4 |